TONE at the

TOP

TONE at the

Providing senior management, boards of directors, and audit committees with concise information on governance-related topics.

Issue 61 | April 2013

Prepared for a Crisis?

Cyber attacks, natural disasters, a chemical leak, the sudden death of a CEO, damaging social media posts, an executive engaged in fraud … the list goes on. Many executives believe it’s only a matter of time before they find

themselves knee-deep in a crisis. In fact, nearly 80 percent of business leaders predict their company will experience a crisis within the next year, according to a recent Crisis Preparation Study by communications firm Burson-Marsteller. A crisis can disrupt operations, shake customer confi- dence, plunge stock value, and wreak havoc on an organization’s reputation.

Yet, only 54 percent of companies participating in the study have a crisis plan, and about half of those plans are deemed insufficient.

“With so much at stake, every company should

Tankersley, executive vice president of CSG Invest- ments and co-author of Board Leadership for the Company in Crisis.* “The idea that it won’t happen to you statistically isn’t borne out.” Tankersley points

out that when a crisis hits, organizations have only a few hours to accomplish literally hundreds of hours worth of work, and ad-hoc responses typically yield mistakes, especially in high-pressure situations.

Professional crisis man- ager Shelby Edwards, principal of ODT &

Associates LLC, agrees.

“Successfully managing a crisis depends almost entirely on what you do before the crisis,” she says.

It’s important that the bulk of the work be done in advance, so organiza- tions can respond quickly and appropriately.

To help business leaders tackle this fear-provoking

spoke with three crisis management experts who offered 10 straightforward tips on preparing for a crisis:

1

Make crisis planning a priority. Consistent support from the board and executive management is needed to sustain a crisis management program.

“That translates into having a clear, visible strategy and an appropriate budget,” Edwards explains.

2

Identify the high-risk scenarios most likely to impact your organization and the degree to which they might disrupt business operations. “Don’t create separate plans for each potential hazard, but plan for a scale of disruption,”

Edwards advises.

3

Assemble a professional crisis team, and make sure everyone on the team knows their roles and responsibilities. The team should include a high-level crisis manager, the CEO, chief financial officer, general counsel, communications professional, internal auditor, and representatives from

across the organization such as finance, human re- sources, and IT. Also, identify ahead of time any external service providers needed to supplement the team — such as a public relations firm or appropriate external counsel.

“When federal agents are arriving to seize your comput- ers, that’s not the time to start googling for a criminal defense attorney,” notes Suzanne Hopgood, president of The Hopgood Group and co-author of Board Leadership for the Company in Crisis.

4

Identify a media spokesperson, typically the CEO, as well as backup spokespersons — in case the CEO is involved in the crisis or specific operational expertise is needed. Provide media training and practice responding to the press.

5

Develop a crisis response plan, including first response protocols, policies, procedures, and a detailed communications plan. Because it’s impossible to plan for every hazard, the crisis plan must be a flexible framework that can be tailored to varying scenarios.

Communication Is Key

Communication missteps during a crisis can add fuel to the fire and essentially spark a secondary crisis that dwarfs the initial problem in terms of damages. “If you solve the initial problem but destroy the company’s reputation in the process, you haven’t done a very good job,” Hopgood quips. Communication best practices include:

■ Take care of employees. Communicate frequently and openly with staff to offer support, address con- cerns, and alleviate worries. Employees can be your best or worst advocates in the community.

■ Identify external audiences and address their communication needs. In the case of a cyberattack, for example, don’t simply notify the 3,000 customers whose information may have been compromised, but remember the 2 million other customers who need reassurance that their information is safe.

■ Communicate quickly, openly, and accurately. Don’t release incomplete or unconfirmed information, which can damage your credibility. Prepare thoughtful communication statements in advance, and be empa- thetic when appropriate. For example, “ABC Co. takes this situation very seriously, and our thoughts are with the families of those impacted by this tragedy. We are conducting a thorough investigation, and we will share the results as soon as they are available.”

■ Monitor social media. The rapid, interconnected nature of social media can create a secondary crisis in and of itself. Listen to the discussion and be prepared to respond in a manner appropriate for this medium.

6

Test the crisis response plan. Perform drills and tabletop exercises to test the plan and team members’ ability to execute their roles. In one extreme case, a CEO — unbe- knownst to the rest of the staff — hired a crisis man- agement firm to put the company’s plan to the test.

Though a risky endeavor, the exercise uncovered a significant problem: a key member of the crisis team was unable to handle the pressure. This important discovery led to a critical revision of the plan.

7

Keep the plan current and accessible.

The plan should be a readily accessible, living framework that’s updated frequently as the organization’s risks change over time, especially when one of the crisis team members leaves the organization, after a crisis simulation, or after a crisis itself.

8

Determine when to initiate the plan.

Crisis training across the organization can prepare staff for how to spot potential prob- lems, how to identify the critical “first-dom- ino” moment that signals the beginning of a crisis, and when to notify higher levels in the organization.

9

Commit to a code of conduct. An ethical culture must be in place in the organization before the first sign of a crisis. “The tone at the top sets the stage,” Hopgood observes.

“If company leaders don’t set the right example, they essentially give everyone else permission to lie or cover up, and that creates a reputational risk from

10

Know when the crisis has ended.

At some point, it’s time to put a cap on the crisis, discontinue ongoing press briefings, resume normal business operations, and refocus the organization’s attention on strategic goals.

Risk Oversight

It’s all about planning, say the experts. And effective planning begins at the top of the organization — with senior management and the board of directors ask- ing probing questions about the organization’s crisis preparation efforts. “It’s incumbent on the board to provide direction and ensure appropriate funding for crisis planning,” stresses Tankersley. “Spending time and resources up front will pay dividends in the long run and is a risk decision boards simply must oversee.”

Questions Boards Should Ask:

1. Does the company have a written crisis response plan that addresses high- impact risks?

2. Has the company performed crisis response simulations?

3. How often is the crisis response plan updated?

4. Is the crisis planning budget adequate?

5. Has the company invested in crisis response skills training?

“By reviewing the organization’s crisis

plan routinely, internal audit can provide assurance on whether the organization is prepared to respond to a crisis.”

—Shelby Edwards

Content Advisory Council

Tone at the Top is pleased to announce the formation of its new Content Advisory Council, a group of esteemed professionals with decades of senior management and corporate board experience.

Martin M. Coyne II has been a director of Akamai Technologies since 2001 and was lead director from 2003 to 2013. Currently he chairs the Compensation Committee and is an Audit Committee member. He also serves as director of RockTech and president and CEO of the National Association of Corporate Directors’ (NACD’s) New Jersey Chapter. Previ- ously, Coyne was a director of BioClinica, OpenPages, Avecia Group Plc, and AdvaMed and director and chairman of Welch Allyn. He is chairman and founder of the CEO Learning Network and author of How To Manage Your Board While Your Board Manages You. Coyne has held a variety of senior management positions, including executive vice president of Eastman Kodak and group executive of its Photography Group.

Nancy A. Eckl chairs the audit committees and is an independent director on the boards of the Lazard Funds Complex and chairs the audit and compliance committees and is an independent trustee on the boards of the College Retirement Equities Fund (CREF)/TIAA- CREF Funds Complex. Prior to her board service, Eckl was vice president of American Beacon Advisors, where she managed the investment programs for American Airlines’ em- ployee benefit plans, the sub-advised American Beacon Funds, and two private equity funds of funds. She began her career with Deloitte Haskins & Sells and is licensed as a Certified Public Accountant in the State of Texas.

Michele J. Hooper is president and CEO of The Directors’ Council. She serves on the corporate boards of PPG Industries Inc. (chair, Audit Committee) and UnitedHealth Group (chair, Nominating and Governance committees). She is a board member of the Center for Audit Quality and the NACD and is president of the NACD Chicago Chapter. Hooper has served as commissioner on the 2004-2013 NACD Blue Ribbon Commissions (BRC) on Governance and co-chaired the 2010 BRC report “The Audit Committee.” She is the recipient of the Directorship 100 Award. Previously, she was president and CEO of Voyager Expanded Learning and of Stadtlander Drug Co. Inc., corporate vice president of Caremark International Inc., and president of the Caremark International Business Group.

Kenton J. Sicchitano is a retired global managing director of PricewaterhouseCoopers, where he worked for more than 30 years. He held a variety of global leadership positions, including global managing partner of Audit and Business Advisory Services and global managing partner responsible for Audit and Business Advisory, Tax, and Financial Advisory Services. Sicchitano serves on the board of directors for PerkinElmer Inc., MetLife Inc., and Analog Devices Inc. He chairs the audit committees of all three companies.

247 Maitland Ave.

Altamonte Springs, FL 32701-4201 USA

TOP

TONE

_{at the}

About The IIA

The Institute of Internal Auditors Inc. (IIA) is an international professional association and standard- setting body that serves as the internal audit profession’s global voice, chief advocate, and principal researcher and educator. The IIA has more than 180,000 members in 190 countries around the world. www.globaliia.org.

Complimentary Subscriptions

You, your colleagues, and your audit committee and board members can receive complimentary subscriptions to Tone at the Top.

Visit www.globaliia.org/Tone-at-the-Top or call +1-407-937-1111.

Quick Poll Results

What do you think about the Three Lines of Defense model?

56.9% – My organization uses this structure.

33.7% – My organization doesn’t use this structure, but I think we should.

7.9% – I’m uncertain whether this model would work in my organization.

1.5% – I’m not interested in this model.

New Poll Question